You can make the java application server ( tomcat for eg:) to run under under privilege .

This was one of the main problems when I build a plugin for cpanel (ndeploy.in) which provides railo( a coldfusion alternative) and I ended up creating certain folders like WEB-INF and logs in the application_root using root privilege .Ofcourse if the CF app has to write something to the application_root that folder must have a 777 permission or write permission for nobody at the least ;same as you would have when running mod_php with nobody privilege.